ZyXEL Communications ZyWall USG 50-H Series, Руководство пользователя

Страница: 427 / 704

Chapter 27 ADP
ZyWALL USG 50-H User’s Guide
427
These are the default base profiles at the time of writing.
27.3.2 Configuring The ADP Profile Summary Screen
Select Anti-X > ADP > Profile .
Figure 358 Anti-X > ADP > Profile
The following table describes the fields in this screen.
27.3.3 Creating New ADP Profiles
You may want to create a new profile if not all rules in a base profile are applicable to your
network. In this case you should disable non-applicable rules so as to improve ZyWALL ADP
processing efficiency.
You may also find that certain rules are triggering too many false positives or false negatives.
A false positive is when valid traffic is flagged as an attack. A false negative is when invalid
traffic is wrongly allowed to pass through the ZyWALL. As each network is different, false
positives and false negatives are common on initial ADP deployment.
You could create a new ‘monitor profile’ that creates logs but all actions are disabled. Observe
the logs over time and try to eliminate the causes of the false alarms. When you’re satisfied
that they have been reduced to an acceptable level, you could then create an ‘inline profile’
whereby you configure appropriate actions to be taken when a packet matches a rule.
Table 149 Base Profiles
BASE PROFILE DESCRIPTION
all All traffic anomaly and protocol anomaly rules are enabled. Rules with a high or
severe severity level (greater than three) generate log alerts and cause packets
that trigger them to be dropped. Rules with a very low, low or medium severity
level (less than or equal to three) generate logs (not log alerts) and no action is
taken on packets that trigger them.
none All traffic anomaly and protocol anomaly rules are disabled. No logs are generated
nor actions are taken.
OK Click OK to save your changes.
Cancel Click Cancel to exit this screen without saving your changes.
Table 150 Anti-X > ADP > Profile
LABEL DESCRIPTION
Name This is the name of the profile you created.
Base Profile This is the base profile from which the profile was created.
Add icon Click the Add icon in the column header to create a new profile. A pop-up screen
displays requiring you to choose a base profile from which to create the new profile.
Click an
Edit icon to edit an existing profile.
Click a Remove icon to delete an existing profile.